Vulnerability-Lookup

GHSA-FPX7-665W-C5C9

Vulnerability from github – Published: 2025-08-28 15:30 – Updated: 2026-01-09 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

tls: separate no-async decryption request handling from async

If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result.

We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 ("tls: fix race between async notify and socket close") took care of it.

This will make the next fix easier.

Severity ?

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-58240"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-28T10:15:31Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: separate no-async decryption request handling from async\n\nIf we\u0027re not doing async, the handling is much simpler. There\u0027s no\nreference counting, we just need to wait for the completion to wake us\nup and return its result.\n\nWe should preferably also use a separate crypto_wait. I\u0027m not seeing a\nUAF as I did in the past, I think aec7961916f3 (\"tls: fix race between\nasync notify and socket close\") took care of it.\n\nThis will make the next fix easier.",
  "id": "GHSA-fpx7-665w-c5c9",
  "modified": "2026-01-09T21:31:32Z",
  "published": "2025-08-28T15:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58240"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/48905146d11dbf1ddbb2967319016a83976953f5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-58240 (GCVE-0-2024-58240)

Vulnerability from cvelistv5 – Published: 2025-08-28 09:40 – Updated: 2025-11-03 17:31

Title

tls: separate no-async decryption request handling from async

Summary

In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 ("tls: fix race between async notify and socket close") took care of it. This will make the next fix easier.

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/48905146d11dbf1dd…
	https://git.kernel.org/stable/c/dec5b6e7b211e405d…
	https://git.kernel.org/stable/c/999115298017a675d…
	https://git.kernel.org/stable/c/41532b785e9d79636…

Impacted products

Vendor

Product

Version

Linux

Affected: 3c4d7559159bfe1e3b94df3a657b2cda3a34e218 , < 48905146d11dbf1ddbb2967319016a83976953f5 (git)
Affected: 3c4d7559159bfe1e3b94df3a657b2cda3a34e218 , < dec5b6e7b211e405d3bcb504562ab21aa7e5a64d (git)
Affected: 3c4d7559159bfe1e3b94df3a657b2cda3a34e218 , < 999115298017a675d8ddf61414fc7a85c89f1186 (git)
Affected: 3c4d7559159bfe1e3b94df3a657b2cda3a34e218 , < 41532b785e9d79636b3815a64ddf6a096647d011 (git)

Linux

Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 6.1.149 , ≤ 6.1.* (semver)
Unaffected: 6.6.21 , ≤ 6.6.* (semver)
Unaffected: 6.7.9 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:31:32.503Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48905146d11dbf1ddbb2967319016a83976953f5",
              "status": "affected",
              "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218",
              "versionType": "git"
            },
            {
              "lessThan": "dec5b6e7b211e405d3bcb504562ab21aa7e5a64d",
              "status": "affected",
              "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218",
              "versionType": "git"
            },
            {
              "lessThan": "999115298017a675d8ddf61414fc7a85c89f1186",
              "status": "affected",
              "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218",
              "versionType": "git"
            },
            {
              "lessThan": "41532b785e9d79636b3815a64ddf6a096647d011",
              "status": "affected",
              "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: separate no-async decryption request handling from async\n\nIf we\u0027re not doing async, the handling is much simpler. There\u0027s no\nreference counting, we just need to wait for the completion to wake us\nup and return its result.\n\nWe should preferably also use a separate crypto_wait. I\u0027m not seeing a\nUAF as I did in the past, I think aec7961916f3 (\"tls: fix race between\nasync notify and socket close\") took care of it.\n\nThis will make the next fix easier."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-08T15:21:47.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48905146d11dbf1ddbb2967319016a83976953f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d"
        },
        {
          "url": "https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186"
        },
        {
          "url": "https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011"
        }
      ],
      "title": "tls: separate no-async decryption request handling from async",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58240",
    "datePublished": "2025-08-28T09:40:33.466Z",
    "dateReserved": "2025-04-16T07:19:43.804Z",
    "dateUpdated": "2025-11-03T17:31:32.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-FPX7-665W-C5C9

CVE-2024-58240 (GCVE-0-2024-58240)

Tags

Sightings

Nomenclature